HashiCorp Nomad vulnerable to a path traversal

Description

References

• nvd.nist.gov/vuln/detail/CVE-2026-7474 · ADVISORY
• hashicorp/nomad commit cd7240c · WEB
• discuss.hashicorp.com/t/hcsec-2026-15-nomad-vulnerable-to-path-traversal-in-dynamic-host-volume-which-may-lead-to-code-execution/77417 · WEB
• hashicorp/nomad · PACKAGE
• hashicorp/nomad release v2.0.1 · WEB
• GitHub Advisory GHSA-hx53-77qj-8663 · ADVISORY

Weitere Schwachstellen in github.com/hashicorp/nomad

• CVE-2026-6959MITTEL 6.0HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to arbitrary file read and write on the client host as the Nomad process …
• CVE-2025-4922HOCH 8.1Nomad Community and Nomad Enterprise (“Nomad”) prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vul…
• CVE-2025-1296MITTEL 6.5Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret tok…
• CVE-2024-12678MITTEL 6.5Nomad Community and Nomad Enterprise ("Nomad") allocations are vulnerable to privilege escalation within a namespace through unredacted work…
• CVE-2024-10975HOCH 7.7Nomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume creation through unaut…